IT Security Resource Library

These are reference guides I maintain and use in my own consulting work — covering open-source application security frameworks, formal information security models, and defense-in-depth architecture. Looking for IT security or database consulting help? Get in touch.

Open Source Application Security Frameworks

A Comprehensive Guide to OWASP and CWE Initiatives in Software & IT Security

Comparing OWASP and CWE in Information Technology & Software Security

The Open Worldwide Application Security Project (OWASP) and the Common Weakness Enumeration (CWE) serve as two foundational, highly complementary open-source initiatives within IT and software security. In modern IT security programs and the Software Development Life Cycle (SDLC), these standards fit together seamlessly.

OWASP operates primarily as a global community-driven framework providing high-level security awareness, strategic governance models (such as OWASP SAMM), testing baselines (OWASP ASVS), and broad operational risk classifications—most notably the OWASP Top 10, which highlights systemic web, API, mobile, and IoT vulnerability categories. OWASP categorizes broad, high-level security risks for web applications and organizational awareness (e.g., A03:2021-Injection or Insecure Design). OWASP provides executive strategy, threat modeling guidelines, and verification frameworks for developers, QA testers, and security managers.

CWE, maintained by the MITRE Corporation, is a standardized catalog and formal dictionary of underlying software and hardware weakness patterns. CWE delivers granular, standardized identifiers (such as CWE-89 for SQL Injection or CWE-79 for Cross-Site Scripting) that describe specific structural flaws in source code or architecture. CWE supplies the precise taxonomy utilized by Static Application Security Testing (SAST) tools, vulnerability scanners, penetration testers, and developers to pinpoint, track, and remediate root-cause vulnerabilities at the code level.

OWASP (Open Worldwide Application Security Project) CWE (Common Weakness Enumeration)

OWASP Official Portal Main Site

The primary community portal offering open-source documentation, projects, local chapter events, and global application security standards.

Access OWASP Official Site →

OWASP Top 10 Project Awareness Standard

Standard awareness document updated every 3–4 years representing broad consensus on the most critical web application security risks (e.g., Broken Access Control, Cryptographic Failures, Insecure Design).

View OWASP Top 10 Project →

OWASP ASVS (Application Security Verification Standard) Testing Framework

A comprehensive framework of requirements and controls for designing, building, and testing secure web applications, heavily utilized by QA teams and security testers.

View OWASP ASVS Project →

OWASP SAMM (Software Assurance Maturity Model) Governance

A strategic framework that helps organizations analyze, formulate, and measure the maturity of their overall software security program.

Access OWASP SAMM Framework →

OWASP API Security Top 10 Specialized Project

Focuses on the top security risks specific to Application Programming Interfaces (APIs), addressing emerging threats like Shadow APIs and broken object-level authorization.

Explore API Security Top 10 →

OWASP Secure Coding Practices Guide SDLC Checklist

Quick-reference checklist for developers providing actionable coding guidance on input validation, session management, authentication, and error handling.

View Secure Coding Guide →

MITRE CWE Official Portal Main Site

The official community-developed repository maintained by MITRE Corporation, establishing standardized terminology for software and hardware weaknesses.

Access MITRE CWE Official Site →

CWE Top 25 Most Dangerous Weaknesses Prioritization List

Periodically updated list of the most critical and widespread software flaws, calculated via NVD data using frequency and severity metrics: (Frequency + Severity) × 100.

Explore CWE Top 25 List →

CWE Catalog & Research Data Taxonomy Database

Full dictionary organized into Categories, specific Weaknesses (e.g., CWE-89, CWE-79), and Views (e.g., Development Phase, Attack Patterns).

Browse Full CWE Catalog →

CWE Hardware Weaknesses (Hardware SIG) Hardware & Firmware

Specialized list focusing on physical, firmware, and hardware design weaknesses (e.g., Improper Isolation of Shared Resources).

View Hardware CWE Content →

Common Weakness Scoring System (CWSS) Scoring Framework

A standardized mechanism for scoring and prioritizing software weaknesses within a specific organization or technical context.

Access CWSS Documentation →

CAPEC Integration (Common Attack Pattern Enumeration) Threat Mapping

MITRE resource mapping CWE weaknesses to real-world adversary attack patterns and exploits for enhanced threat modeling.

Explore CAPEC Attack Patterns →

Information Security Models

Comprehensive Overview of Access Control, Integrity, Confidentiality, and Governance Models

Security Models

Security models serve as formal frameworks that specify rules of behavior for systems and subjects to meet core security objectives by controlling information flow. They guide access control implementations and enforce the principles of Confidentiality, Integrity, and Availability (CIA). Below is a detailed summary of six foundational security models, their recommended security actions, and community-supported open references.

1. Bell-LaPadula Model (BLP) Confidentiality / Secrecy

Developed by David Bell and Leonard LaPadula, the Bell-LaPadula model is a state-machine framework primarily concerned with preserving data confidentiality in Mandatory Access Control (MAC) environments. It is widely applied in government and military contexts where data is categorized into hierarchical classification levels (e.g., Unclassified, Confidential, Secret, Top Secret).

Recommended Security Actions & Implementation Rules:
  • Enforce "No Read Up" (Simple Security Property): Prevent subjects with a lower clearance level from reading data classified at a higher sensitivity level.
  • Enforce "No Write Down" (* / Star Property): Prevent subjects operating at a higher security level from writing or copying data to a lower classification level, effectively stopping unauthorized data leakage or Trojan horse exfiltration.
  • Apply Strong Star Property: Restrict subjects to reading and writing data only if the classification level of the object exactly matches the clearance level of the subject.
Community Resource: Wikipedia: Bell–LaPadula Model →

2. Biba Model Data Integrity

In contrast to Bell-LaPadula, the Biba model focuses strictly on maintaining data and system integrity. It ensures information accuracy and reliability, making it essential for financial institutions, healthcare environments, and critical software development systems.

Recommended Security Actions & Implementation Rules:
  • Enforce "No Write Up" (Simple Integrity Property): Block subjects at lower integrity levels from writing to or modifying data at higher integrity levels, ensuring untrusted sources cannot corrupt critical assets.
  • Enforce "No Read Down" (Integrity Star Property): Prevent higher integrity subjects/processes from reading data from lower integrity levels, ensuring unreliable or unverified data does not corrupt high-integrity decisions.
  • Apply Strong Star Property: Restrict subjects to interacting (reading/writing) only with data that shares their exact integrity level.
  • Enforce Invocation Property: Prevent a lower integrity subject from invoking or initiating processes/messages at a higher integrity level.
Community Resource: Learn Security Management: Biba Integrity Model Guide →

3. Clark-Wilson Model Commercial Integrity

The Clark-Wilson model preserves commercial data integrity by enforcing approved transactional paths rather than relying solely on lattice clearance levels. It is the foundation for enterprise systems (such as ERP and banking software) to prevent fraud and unauthorized data modification.

Recommended Security Actions & Implementation Rules:
  • Mandate Well-Formed Transactions via Transformation Procedures (TPs): Ensure subjects cannot access or modify Constrained Data Items (CDIs) directly, requiring all operations to pass through authorized intermediary programs or DBMS interfaces.
  • Enforce Separation of Duties: Require different subjects to create and approve transactions to prevent internal fraud.
  • Execute Integrity Verification Procedures (IVPs): Conduct regular automated procedures that audit and confirm all CDIs are in a valid, uncorrupted state.
  • Implement Least Privilege & Comprehensive Auditing: Grant minimal necessary rights and maintain immutable logs of all transactional changes.
Community Resource: Wikipedia: Clark–Wilson Model →

4. Brewer-Nash Model (Chinese Wall) Conflict of Interest

The Brewer and Nash model addresses conflicts of interest in environments where consultants, legal advisors, or multi-tenant cloud platforms handle sensitive data from competing organizations.

Recommended Security Actions & Implementation Rules:
  • Enforce Dynamic Access Restrictions ("Chinese Wall Rule"): Restrict access dynamically based on a user's access history—once a user reads data from one company, automatically block access to all competing datasets within that conflict class.
  • Maintain Logical Data Isolation: Enforce strict logical boundaries in SaaS and multi-client environments to guarantee absence of ethical conflicts and insider data leakage.
Community Resource: Wikipedia: Brewer and Nash Model →

5. Graham-Denning Model Access Rights Management

The Graham-Denning model provides a formal framework governing the granular creation, deletion, and assignment of access rights between subjects and objects in dynamic, multi-user, or distributed systems.

Recommended Security Actions & Implementation Rules:
  • Assign Object Ownership: Ensure every system object has a designated owner with explicit authority to grant or revoke access permissions.
  • Enforce Eight Protection Primitives: Implement formal rules governing how to securely:
    • Create Object / Create Subject
    • Delete Object / Delete Subject
    • Read Access Right / Grant Access Right / Delete Access Right / Transfer Access Right.
Community Resource: Wikipedia: Graham–Denning Model →

6. Harrison-Ruzzo-Ullman (HRU) Model Access Control Matrix

The HRU model is a theoretical framework that models computer security system states using access matrices and generic primitive commands to analyze information flow and clearance lattice security.

Recommended Security Actions & Implementation Rules:
  • Maintain Access Control Matrix: Map subjects (rows), objects/subjects (columns), and explicit privilege cells (Read, Write, Execute) to dictate rights.
  • Analyze System Safety & State Transitions: Evaluate primitive request sequences to verify that permissions cannot propagate to unauthorized subjects, accounting for undecidability limitations in complex systems by adopting constrained models like RBAC.
Community Resource: Wikipedia: HRU Security Model →

Quick Reference & Model Comparison

Security Model Primary Objective Core Focus / Application Field Primary Rule / Feature
Bell-LaPadula (BLP) Confidentiality Military & Government Systems No Read Up, No Write Down
Biba Data Integrity Finance, Healthcare, Software No Write Up, No Read Down
Clark-Wilson Commercial Integrity ERP & Financial Software Well-Formed Transactions & Separation of Duties
Brewer-Nash (Chinese Wall) Conflict of Interest Mitigation Consulting, Legal & Multi-Tenant Cloud Dynamic Barriers Based on Access History
Graham-Denning Access Rights Management Distributed & Collaborative File Systems 8 Protection Primitives & Object Ownership
Harrison-Ruzzo-Ullman (HRU) Access Matrix Safety Analysis High-Security Classified Systems Access Matrix & Finite Primitive Commands

Defense In Depth (Layered Defenses)

Comprehensive Architectural Security & Multilayered Risk Mitigation

Defense In Depth Overview

Defense in Depth (also referred to as Layered Defenses) is a comprehensive cybersecurity strategy that employs multiple redundant layers of security controls across an organization's ecosystem. The core objective of this strategy is to eliminate single points of failure; if a primary defensive control (such as a network perimeter firewall) is breached or rendered non-functional, backup or compensating controls (such as host-based firewalls, application controls, or encryption) step in to provide correction and protection.

It is critical to recognize that defense in depth is not a foolproof strategy, and no single security measure guarantees 100% protection against all threat vectors. The only scenario with absolute zero technical risk is a completely air-gapped, isolated environment with zero external interaction—a setup that is entirely unfeasible for modern business operations. Consequently, organizations must continuously evaluate, adapt, and refine their defense controls by leveraging current threat intelligence.

Core Technical Layers

1. Network Layer

  • Network Firewalls
  • Intrusion Prevention Systems (IPS / Virtual Patching)
  • Network Access Control (NAC) & VLAN Segmentation

2. Host / Endpoint Layer

  • Host-based Firewalls (e.g., Windows Defender)
  • Antivirus & Endpoint Protection (EDR)
  • OS Patching & Configuration Baselines

3. Application Layer

  • Secure Coding (Input Sanitization, Parameterized Queries)
  • Patch Management
  • Web Application Access Control

4. Data Layer

  • Encryption at Rest & in Transit
  • Digital Rights Management (DRM)
  • Access Control & Data Labeling

Physical & Human Security Dimensions

Defense in Depth extends beyond purely technical mechanisms to incorporate Physical Security and the Human Layer:

  • Physical Security: Fences, locks, cameras, and physical access controls safeguard premises and servers. Without physical security, perimeter digital controls become ineffective.
  • Human Layer & Security Culture: User education and awareness training enable staff to recognize social engineering and phishing threats. Securing buy-in from management, business departments, and end-users establishes a resilient security culture.
Security Models & Framework Perspectives

The Castle & Moat vs. Zero Trust: Traditionally visualized as a medieval castle (moat = perimeter firewall, walls = host security, keep = encryption). Modern security architecture evolves this into Zero Trust, assuming the perimeter moat has already been crossed and requiring every internal boundary to verify explicitly.

The Swiss Cheese Model: Originating from James Reason's risk management theory, security layers are viewed as slices of Swiss cheese. While every individual layer has holes (vulnerabilities), stacking multiple slices prevents alignment, ensuring a threat cannot pass completely through all defenses.

The Defense in Depth Lifecycle

A structured Defense in Depth strategy is organized around six sequential lifecycle phases:

  1. Prevention: Stopping attacks before impact (e.g., Firewalls, Authentication).
  2. Containment: Limiting blast radius if prevention fails (e.g., Network Segmentation, DDoS Scrubbing).
  3. Detection / Notification: Alerting incident teams to anomalies (e.g., IDS, SIEM, Honeypots).
  4. Reaction: Executing incident response, policy updates, and dynamic controls.
  5. Evidence Collection / Event Tracking: Maintaining forensics, auditing, and nonrepudiation.
  6. Recovery / Restoration: Business continuity, backups, failover sites, and service restoration.

Summary Matrix: Defenses Against System Compromise

Lifecycle Defense Phase Associated Policies, Standards, Procedures & Technologies
Prevention Authentication, Authorization, Encryption, Firewalls, Data labeling/handling/retention, Management, Physical security, Intrusion prevention, Virus scanning, Personnel security, Awareness and training.
Containment Authorization, Data privacy, Firewalls/security domains, Network segmentation, Physical security.
Detection / Notification Monitoring, Measurements/metrics, Auditing/logging, Honeypots, Intrusion detection, Virus detection.
Reaction Incident response, Policy/procedure change, Additional security mechanisms, New/better controls.
Evidence Collection / Event Tracking Auditing/logging, Management/monitoring, Nonrepudiation, Forensics.
Recovery / Restoration Backups/restoration, Failover/remote sites, Business continuity/disaster recovery planning.

Open Source & Community Supported Web Resources

OWASP Cheat Sheet Series: OWASP Defense in Depth Guidance →

Community-driven secure architecture and layered application security guidelines.

NIST Computer Security Resource Center (CSRC): NIST SP 800 Series Security Frameworks →

Official standards for engineering layered security controls across government and commercial systems.

CISA Shields Up & Cyber Essentials: CISA Organizational Defense Guidelines →

Publicly accessible cybersecurity guidance for multi-tiered threat prevention, incident response, and recovery.